@sparkelf/dsh-plugin-dataops 0.1.0-rc.10

package/lib/index.js

@@ -0,0 +1,499 @@
+import { createHash, randomBytes } from "node:crypto";
+import { MAX_TIMER_DELAY_MS } from "@deepseek-ai/dsh-timeout";
+import z from "@deepseek-ai/schemastery";
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import * as McpClient from "@sparkelf/dsh-plugin-mcp-credentials";
+//#region lib/types/index.js
+/**
+* Standalone DataOps MCP integration. It owns one persistent DSH target
+* identity, the browser Authorization Code + PKCE handoff, and a generic
+* authenticated MCP client for the target's immutable principal.
+* @module @sparkelf/dsh-plugin-dataops
+*/
+/** Cordis plugin name for the standalone DataOps integration. */
+const name = "mcp-dataops";
+/** Services required by the standalone authorization and MCP composition. */
+const inject = [
+	"connection",
+	"credentials",
+	"webServer",
+	"tools"
+];
+const CLIENT_ID = "deepseek-harness-plus";
+const SCOPE = "openid dataops.mcp";
+const INTEGRATION_PATH = "/integrations/dataops";
+const STATUS_PATH = `${INTEGRATION_PATH}/status`;
+const CONNECT_PATH = `${INTEGRATION_PATH}/connect`;
+const CALLBACK_PATH = `${INTEGRATION_PATH}/callback`;
+const DISCONNECT_PATH = `${INTEGRATION_PATH}/disconnect`;
+const PENDING_TTL_MS = 600 * 1e3;
+const TARGET_REF_PATTERN = /^[A-Za-z0-9_-]{32,128}$/u;
+/** Schemastery parser for standalone DataOps integration configuration. */
+const Config = z.object({
+	baseUrl: z.string().required(),
+	serverName: z.string().default("dataops"),
+	credentialRef: z.string().role("credential-ref").required(),
+	targetCredentialRef: z.string().role("credential-ref").required(),
+	callbackOrigin: z.string(),
+	toolCallTimeoutMs: z.number().min(1).default(6e4),
+	failOnStartupError: z.boolean().default(false)
+});
+function normalizeHttpOrigin(value, invalidMessage, componentMessage) {
+	if (!URL.canParse(value)) throw new Error(invalidMessage);
+	const url = new URL(value);
+	if (!["http:", "https:"].includes(url.protocol) || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error(componentMessage);
+	return url.origin;
+}
+function normalizeBaseUrl(value) {
+	return normalizeHttpOrigin(value, "mcp-dataops: baseUrl must be an absolute http(s) origin", "mcp-dataops: baseUrl must be an http(s) origin without path, query, credentials, or fragment");
+}
+function normalizeCallbackOrigin(value) {
+	return normalizeHttpOrigin(value, "mcp-dataops: callbackOrigin must be an absolute browser origin", "mcp-dataops: callbackOrigin must be an HTTP or HTTPS origin without path, query, credentials, or fragment");
+}
+function isLoopbackRequest(request) {
+	const address = request.socket.remoteAddress;
+	return address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
+}
+function requireConnection(ctx, request, response) {
+	const rejection = ctx.connection.requestRejection(request);
+	if (rejection === void 0) return true;
+	response.writeHead(rejection);
+	response.end();
+	return false;
+}
+function requireLoopback(request, response) {
+	if (isLoopbackRequest(request)) return true;
+	response.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+	response.end("DataOps authorization management accepts only DSH loopback ingress.");
+	return false;
+}
+function requireSameOriginBrowser(request, response) {
+	if (request.headers["sec-fetch-site"] === "same-origin") return true;
+	response.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+	response.end("DataOps authorization management accepts only same-origin DSH browser requests.");
+	return false;
+}
+function requireMethod(request, response, method) {
+	if (request.method === method) return true;
+	response.writeHead(405, { allow: method });
+	response.end();
+	return false;
+}
+function sendJson(response, status, value) {
+	response.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	response.end(JSON.stringify(value));
+}
+function popupBridge(response, result, reason) {
+	const payload = JSON.stringify({
+		type: "dsh:dataops-oauth",
+		result,
+		reason
+	});
+	response.writeHead(200, {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": "no-store",
+		"referrer-policy": "no-referrer"
+	});
+	response.end(`<!doctype html><html><head><meta charset="utf-8"><title>DataOps</title></head><body><script>if(window.opener){window.opener.postMessage(${payload},window.location.origin);window.close()}else{window.location.replace('/')}<\/script></body></html>`);
+}
+function callbackOriginOf(request, response) {
+	const rawOrigin = new URL(request.url ?? CONNECT_PATH, "http://dsh.local").searchParams.get("origin") ?? "";
+	if (!URL.canParse(rawOrigin)) {
+		sendJson(response, 400, { error: "The DSH browser origin is invalid." });
+		return;
+	}
+	const candidate = new URL(rawOrigin);
+	const loopback = candidate.hostname === "127.0.0.1" || candidate.hostname === "localhost" || candidate.hostname === "[::1]";
+	const requestHost = request.headers.host?.trim().toLowerCase() ?? "";
+	if (!["http:", "https:"].includes(candidate.protocol) || candidate.username !== "" || candidate.password !== "" || candidate.pathname !== "/" || candidate.search !== "" || candidate.hash !== "" || !loopback || candidate.host.toLowerCase() !== requestHost) {
+		sendJson(response, 400, { error: "The DSH browser origin does not match this DSH host." });
+		return;
+	}
+	return candidate.origin;
+}
+function parseTargetRef(value) {
+	if (!TARGET_REF_PATTERN.test(value)) throw new Error("mcp-dataops: target credential must contain a 32-128 character base64url identifier");
+	return value;
+}
+function parseTokenResponse(value) {
+	if (!value || typeof value !== "object") throw new Error("DataOps token endpoint returned an invalid response");
+	const record = value;
+	if (typeof record.access_token !== "string" || record.access_token.length === 0 || record.token_type !== "Bearer" || record.scope !== SCOPE) throw new Error("DataOps token endpoint returned an invalid response");
+	return record;
+}
+function accessTokenExpiry(accessToken) {
+	const payload = accessToken.split(".")[1];
+	if (payload === void 0) throw new Error("DataOps access token does not contain a JWT payload");
+	let value;
+	try {
+		value = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+	} catch (error) {
+		throw new Error("DataOps access token contains an invalid JWT payload", { cause: error });
+	}
+	if (!value || typeof value !== "object") throw new Error("DataOps access token JWT payload must be an object");
+	const expiresAt = value.exp;
+	if (typeof expiresAt !== "number" || !Number.isInteger(expiresAt)) throw new Error("DataOps access token JWT payload must contain an integer exp");
+	const delay = expiresAt * 1e3 - Date.now();
+	if (delay <= 0 || delay > MAX_TIMER_DELAY_MS) throw new Error("DataOps access token exp is outside the supported timer range");
+	return expiresAt * 1e3;
+}
+function parseAccountResponse(value) {
+	if (!value || typeof value !== "object") throw new Error("DataOps userinfo endpoint returned an invalid response");
+	const record = value;
+	if (typeof record.preferred_username !== "string" || typeof record.name !== "string" || typeof record.email !== "string") throw new Error("DataOps userinfo endpoint returned an invalid response");
+	return {
+		username: record.preferred_username,
+		displayName: record.name,
+		email: record.email
+	};
+}
+/**
+* Compose the DataOps browser authorization routes and generic MCP child.
+* @param ctx - Cordis context with credentials, Web routes, and tool registry.
+* @param config - Standalone DataOps origin, credential references, and MCP settings.
+* @returns Startup readiness after the persistent target and stored grant are accepted.
+*/
+async function apply(ctx, config) {
+	const baseUrl = normalizeBaseUrl(config.baseUrl);
+	const callbackOrigin = config.callbackOrigin === void 0 ? void 0 : normalizeCallbackOrigin(config.callbackOrigin);
+	const accessRef = credentialRef(config.credentialRef);
+	const targetRefKey = credentialRef(config.targetCredentialRef);
+	const targetState = await ctx.credentials.describe(targetRefKey);
+	if (!targetState.configured) {
+		if (!targetState.writable) throw new Error("mcp-dataops: targetCredentialRef must be configured or use a writable credential source");
+		await ctx.credentials.set(targetRefKey, randomBytes(32).toString("base64url"));
+	}
+	const resolvedTarget = await ctx.credentials.resolve(targetRefKey);
+	if (resolvedTarget === void 0) throw new Error("mcp-dataops: target credential could not be resolved after initialization");
+	const targetRef = parseTargetRef(resolvedTarget.value);
+	const pending = /* @__PURE__ */ new Map();
+	const lifecycleAbort = new AbortController();
+	const activeOperations = /* @__PURE__ */ new Set();
+	let mcpFiber;
+	let grantGeneration = 0;
+	let accessExpiresAt = null;
+	const assertActive = () => {
+		if (lifecycleAbort.signal.aborted) throw new Error("mcp-dataops: plugin lifecycle is disposed");
+	};
+	const assertGrantCurrent = (expectedGeneration) => {
+		if (grantGeneration !== expectedGeneration) throw new Error("mcp-dataops: delegated grant operation was superseded");
+	};
+	const trackOperation = (operation) => {
+		activeOperations.add(operation);
+		operation.then(() => {
+			activeOperations.delete(operation);
+		}, () => {
+			activeOperations.delete(operation);
+		});
+		return operation;
+	};
+	const trackHandler = (handler) => (request, response) => trackOperation(handler(request, response));
+	const mcpConfig = () => ({
+		transport: "streamable-http",
+		serverName: config.serverName,
+		url: `${baseUrl}/api/ai/data-query/mcp`,
+		headers: {},
+		bearerTokenRef: accessRef,
+		toolCallTimeoutMs: config.toolCallTimeoutMs,
+		failOnStartupError: config.failOnStartupError
+	});
+	const isMcpMounted = () => mcpFiber !== void 0 && mcpFiber.uid !== null;
+	const ensureMcpMounted = async () => {
+		assertActive();
+		if (isMcpMounted()) return;
+		const fiber = ctx.plugin(McpClient, mcpConfig());
+		mcpFiber = fiber;
+		try {
+			await fiber.await();
+			assertActive();
+		} catch (error) {
+			ctx.logger.error("mcp-dataops: MCP client mount failed");
+			ctx.logger.error(error);
+			if (mcpFiber === fiber) mcpFiber = void 0;
+			try {
+				await fiber.dispose();
+			} catch (cleanupError) {
+				ctx.logger.error("mcp-dataops: MCP mount failure cleanup failed");
+				ctx.logger.error(cleanupError);
+				throw new AggregateError([error, cleanupError], "DataOps MCP mount and cleanup failed");
+			}
+			throw error;
+		}
+	};
+	const unmountMcp = async () => {
+		const fiber = mcpFiber;
+		mcpFiber = void 0;
+		if (fiber !== void 0 && fiber.uid !== null) await fiber.dispose();
+	};
+	ctx.effect(() => async () => {
+		pending.clear();
+		lifecycleAbort.abort();
+		await Promise.allSettled([...activeOperations]);
+		await unmountMcp();
+	}, "mcp-dataops: authorization lifecycle");
+	const credentialState = async () => {
+		const access = await ctx.credentials.describe(accessRef);
+		return {
+			configured: access.configured,
+			writable: access.writable
+		};
+	};
+	const fetchAccount = async (accessToken) => {
+		const response = await fetch(new URL("/api/auth/dsh/userinfo", baseUrl), {
+			headers: { authorization: `Bearer ${accessToken}` },
+			signal: lifecycleAbort.signal
+		});
+		if (response.status === 401 || response.status === 403) return null;
+		if (!response.ok) throw new Error(`DataOps userinfo lookup failed with HTTP ${String(response.status)}`);
+		return parseAccountResponse(await response.json());
+	};
+	const currentAccount = async () => {
+		const state = await credentialState();
+		if (!state.configured) return {
+			credential: state,
+			account: null,
+			authorizationAccepted: false
+		};
+		const resolved = await ctx.credentials.resolve(accessRef);
+		if (resolved === void 0) throw new Error("DataOps access credential is described as configured but cannot be resolved");
+		const account = await fetchAccount(resolved.value);
+		return {
+			credential: state,
+			account,
+			authorizationAccepted: account !== null && isMcpMounted()
+		};
+	};
+	const requestRevocation = async (token) => {
+		const response = await fetch(new URL("/api/auth/dsh/revoke", baseUrl), {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({ token }),
+			signal: lifecycleAbort.signal
+		});
+		if (!response.ok) throw new Error(`DataOps token revocation failed with HTTP ${String(response.status)}`);
+	};
+	const revokeTokenResponse = (token) => requestRevocation(token.access_token);
+	const restoreCredential = async (ref, previous) => {
+		if (previous === void 0) await ctx.credentials.unset(ref);
+		else await ctx.credentials.set(ref, previous.value);
+	};
+	const storeAuthorization = async (token, expectedGeneration) => {
+		assertActive();
+		assertGrantCurrent(expectedGeneration);
+		const previousAccess = await ctx.credentials.resolve(accessRef);
+		const previousExpiresAt = accessExpiresAt;
+		assertActive();
+		assertGrantCurrent(expectedGeneration);
+		try {
+			await ctx.credentials.set(accessRef, token.access_token);
+			accessExpiresAt = accessTokenExpiry(token.access_token);
+			assertActive();
+			assertGrantCurrent(expectedGeneration);
+		} catch (error) {
+			ctx.logger.error("mcp-dataops: DataOps credential replacement failed");
+			ctx.logger.error(error);
+			try {
+				await restoreCredential(accessRef, previousAccess);
+				accessExpiresAt = previousExpiresAt;
+			} catch (rollbackError) {
+				ctx.logger.error("mcp-dataops: DataOps credential rollback failed");
+				ctx.logger.error(rollbackError);
+				throw new AggregateError([error, rollbackError], "DataOps credential replacement and rollback failed");
+			}
+			throw error;
+		}
+		return async () => {
+			await restoreCredential(accessRef, previousAccess);
+			accessExpiresAt = previousExpiresAt;
+		};
+	};
+	const acceptAuthorization = async (token, expectedGeneration) => {
+		const restore = await storeAuthorization(token, expectedGeneration);
+		try {
+			await ensureMcpMounted();
+		} catch (error) {
+			ctx.logger.error("mcp-dataops: DataOps authorization commit failed");
+			ctx.logger.error(error);
+			try {
+				await restore();
+			} catch (rollbackError) {
+				ctx.logger.error("mcp-dataops: DataOps authorization rollback failed");
+				ctx.logger.error(rollbackError);
+				throw new AggregateError([error, rollbackError], "DataOps authorization commit and rollback failed");
+			}
+			throw error;
+		}
+	};
+	if ((await credentialState()).configured) try {
+		const access = await ctx.credentials.resolve(accessRef);
+		if (access === void 0 || await fetchAccount(access.value) === null) throw new Error("Stored DataOps access credential was rejected by userinfo");
+		accessExpiresAt = accessTokenExpiry(access.value);
+		await ensureMcpMounted();
+	} catch (error) {
+		ctx.logger.warn("mcp-dataops: stored DataOps authorization could not be accepted");
+		ctx.logger.warn(error);
+	}
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: STATUS_PATH,
+		handler: trackHandler(async (request, response) => {
+			if (!requireConnection(ctx, request, response) || !requireLoopback(request, response) || !requireSameOriginBrowser(request, response) || !requireMethod(request, response, "GET")) return;
+			try {
+				const accountState = await currentAccount();
+				sendJson(response, 200, {
+					baseUrl,
+					serverName: config.serverName,
+					credentialConfigured: accountState.credential.configured,
+					credentialWritable: accountState.credential.writable,
+					authorizationAccepted: accountState.authorizationAccepted,
+					expiresAt: accountState.authorizationAccepted ? accessExpiresAt : null,
+					account: accountState.account
+				});
+			} catch (error) {
+				ctx.logger.warn("mcp-dataops: integration status lookup failed");
+				ctx.logger.warn(error);
+				sendJson(response, 502, { error: "Unable to read DataOps connection status." });
+			}
+		})
+	}), "mcp-dataops: status route");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: CONNECT_PATH,
+		handler: trackHandler(async (request, response) => {
+			if (!requireConnection(ctx, request, response) || !requireLoopback(request, response) || !requireSameOriginBrowser(request, response) || !requireMethod(request, response, "GET")) return;
+			const state = await credentialState();
+			assertActive();
+			if (!state.writable) {
+				sendJson(response, 409, { error: "DataOps access credential must use a writable credential source." });
+				return;
+			}
+			pending.clear();
+			const browserOrigin = callbackOrigin ?? callbackOriginOf(request, response);
+			if (browserOrigin === void 0) return;
+			const stateValue = randomBytes(32).toString("base64url");
+			const verifier = randomBytes(32).toString("base64url");
+			const challenge = createHash("sha256").update(verifier, "ascii").digest("base64url");
+			const redirectUri = `${browserOrigin}${CALLBACK_PATH}`;
+			pending.set(stateValue, {
+				verifier,
+				redirectUri,
+				createdAt: Date.now()
+			});
+			const authorize = new URL("/api/auth/dsh/authorize", baseUrl);
+			authorize.searchParams.set("client_id", CLIENT_ID);
+			authorize.searchParams.set("target_ref", targetRef);
+			authorize.searchParams.set("redirect_uri", redirectUri);
+			authorize.searchParams.set("response_type", "code");
+			authorize.searchParams.set("state", stateValue);
+			authorize.searchParams.set("code_challenge", challenge);
+			authorize.searchParams.set("code_challenge_method", "S256");
+			authorize.searchParams.set("scope", SCOPE);
+			authorize.searchParams.set("prompt", "select_account");
+			response.writeHead(303, {
+				location: authorize.toString(),
+				"referrer-policy": "no-referrer"
+			});
+			response.end();
+		})
+	}), "mcp-dataops: connect route");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: CALLBACK_PATH,
+		handler: trackHandler(async (request, response) => {
+			if (!requireConnection(ctx, request, response) || !requireLoopback(request, response) || !requireMethod(request, response, "GET")) return;
+			const callback = new URL(request.url ?? CALLBACK_PATH, "http://127.0.0.1");
+			const stateValue = callback.searchParams.get("state") ?? "";
+			const authorization = pending.get(stateValue);
+			pending.delete(stateValue);
+			if (authorization === void 0 || Date.now() - authorization.createdAt > PENDING_TTL_MS) {
+				ctx.logger.warn("mcp-dataops: authorization callback rejected missing or expired pending state");
+				popupBridge(response, "failed", "pending-state");
+				return;
+			}
+			if (callback.searchParams.get("error") !== null) {
+				popupBridge(response, "cancelled");
+				return;
+			}
+			const code = callback.searchParams.get("code") ?? "";
+			if (code === "") {
+				ctx.logger.warn("mcp-dataops: authorization callback rejected missing code");
+				popupBridge(response, "failed", "missing-code");
+				return;
+			}
+			const expectedGeneration = grantGeneration;
+			let token;
+			let failureReason = "token-service-failed";
+			try {
+				const tokenResponse = await fetch(new URL("/api/auth/dsh/token", baseUrl), {
+					method: "POST",
+					headers: { "content-type": "application/x-www-form-urlencoded" },
+					body: new URLSearchParams({
+						grant_type: "authorization_code",
+						code,
+						client_id: CLIENT_ID,
+						redirect_uri: authorization.redirectUri,
+						code_verifier: authorization.verifier
+					}),
+					signal: lifecycleAbort.signal
+				});
+				if (!tokenResponse.ok) {
+					if (tokenResponse.status === 400) failureReason = "token-request-rejected";
+					else if (tokenResponse.status === 401 || tokenResponse.status === 403) failureReason = "token-account-rejected";
+					else failureReason = "token-service-failed";
+					throw new Error(`DataOps token exchange failed with HTTP ${String(tokenResponse.status)}`);
+				}
+				failureReason = "token-response-invalid";
+				token = parseTokenResponse(await tokenResponse.json());
+				failureReason = "account-verification";
+				if (await fetchAccount(token.access_token) === null) throw new Error("DataOps access token was rejected by userinfo");
+				failureReason = "authorization-activation";
+				await acceptAuthorization(token, expectedGeneration);
+			} catch (error) {
+				ctx.logger.warn("mcp-dataops: DataOps authorization callback failed");
+				ctx.logger.warn(error);
+				if (token !== void 0) try {
+					await revokeTokenResponse(token);
+				} catch (revocationError) {
+					ctx.logger.warn("mcp-dataops: rejected DataOps authorization grant revocation failed");
+					ctx.logger.warn(revocationError);
+				}
+				popupBridge(response, "failed", failureReason);
+				return;
+			}
+			popupBridge(response, "connected");
+		})
+	}), "mcp-dataops: callback route");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: DISCONNECT_PATH,
+		handler: trackHandler(async (request, response) => {
+			if (!requireConnection(ctx, request, response) || !requireLoopback(request, response) || !requireSameOriginBrowser(request, response) || !requireMethod(request, response, "POST")) return;
+			const state = await credentialState();
+			assertActive();
+			if (!state.writable) {
+				sendJson(response, 409, { error: "DataOps access credential must use a writable credential source." });
+				return;
+			}
+			grantGeneration += 1;
+			pending.clear();
+			try {
+				const access = await ctx.credentials.resolve(accessRef);
+				assertActive();
+				await unmountMcp();
+				if (access !== void 0) await requestRevocation(access.value);
+				await ctx.credentials.unset(accessRef);
+				accessExpiresAt = null;
+				sendJson(response, 200, { disconnected: true });
+			} catch (error) {
+				ctx.logger.warn("mcp-dataops: DataOps disconnect failed");
+				ctx.logger.warn(error);
+				sendJson(response, 502, { error: "Unable to disconnect DataOps." });
+			}
+		})
+	}), "mcp-dataops: disconnect route");
+}
+//#endregion
+export { Config, apply, inject, name };

package/lib/invariant.js

@@ -0,0 +1,16 @@
+//#region lib/types/invariant.js
+const PACKAGE_NAME = "@sparkelf/dsh-plugin-dataops";
+/** Cordis plugin name for the DataOps invariant companion. */
+const name = "mcp-dataops-invariant";
+/** Services required to register the package invariant installer. */
+const inject = ["invariants"];
+/** No runtime invariant: the package owns browser OAuth handoff and a child mcp-client fiber, not a separate durable projection. */
+const install = () => {};
+/**
+* Register the package's explained empty invariant installer.
+* @param ctx - Cordis context with the invariant registry.
+* @returns The registration disposer.
+*/
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/lib/types/client/DataOpsExpiryModal.d.ts

@@ -0,0 +1,12 @@
+import type { PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots';
+import type { DataOpsInjectedProps } from './contract.ts';
+import { createDataOpsStore } from './store.ts';
+/** Full props for the frame-wide DataOps authorization prompt. */
+export type DataOpsExpiryModalProps = PropsRuntime<'shell.overlay'> & PropsStore<ReturnType<typeof createDataOpsStore>> & DataOpsInjectedProps;
+/**
+ * Render the frame-wide expired-sign-in prompt and own its browser lifecycle.
+ * @param props - Root-scoped overlay owner, shared store, and injected callbacks.
+ * @returns The modal contribution, or nothing before injection or expiry.
+ */
+export declare function DataOpsExpiryModal(props: DataOpsExpiryModalProps): import("react").JSX.Element | null;
+//# sourceMappingURL=DataOpsExpiryModal.d.ts.map

package/lib/types/client/DataOpsSection.d.ts

@@ -0,0 +1,12 @@
+import type { PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots';
+import type { DataOpsInjectedProps } from './contract.ts';
+import { createDataOpsStore } from './store.ts';
+/** Full props for the DataOps Settings contribution. */
+export type DataOpsSectionProps = PropsRuntime<'settings.section'> & PropsStore<ReturnType<typeof createDataOpsStore>> & DataOpsInjectedProps;
+/**
+ * Render the DataOps connection state and authorization controls.
+ * @param props - Root-scoped Settings owner, store, and injected callbacks.
+ * @returns The localized Settings section, or nothing before injection.
+ */
+export declare function DataOpsSection(props: DataOpsSectionProps): import("react").JSX.Element | null;
+//# sourceMappingURL=DataOpsSection.d.ts.map

package/lib/types/client/contract.d.ts

@@ -0,0 +1,18 @@
+import type { InjectFace } from '@deepseek-ai/dsh-client-ui-slots';
+import type { en } from './locales.ts';
+/** Callbacks and localized copy shared by both DataOps Client entries. */
+export interface DataOpsClientInjected {
+    /** Translate one DataOps UI message key. */
+    t: (key: keyof typeof en) => string;
+    /** Start the always-mounted status and OAuth browser lifecycle. */
+    start: () => () => void;
+    /** Refresh the authoritative Host status. */
+    reload: () => void;
+    /** Open the real DataOps OAuth popup from a user gesture. */
+    openAuthorization: () => void;
+    /** Disconnect the delegated grant and report whether it completed. */
+    disconnect: () => Promise<boolean>;
+}
+/** Optional injected face while the slot registration is activating. */
+export type DataOpsInjectedProps = Partial<InjectFace<DataOpsClientInjected>>;
+//# sourceMappingURL=contract.d.ts.map

package/lib/types/client/controller.d.ts

@@ -0,0 +1,33 @@
+import type { DataOpsActions } from './store.ts';
+/** Own browser status refresh, OAuth popup handoff, and expiry notification timing. */
+export declare class DataOpsController {
+    private actions;
+    private authorizationPopup;
+    private expiryTimer;
+    /**
+     * Attach the root-scoped store actions supplied by a slot registration.
+     * @param actions - Bound writes for the shared DataOps Client store.
+     */
+    attach(actions: DataOpsActions): void;
+    private writes;
+    private clearExpiryTimer;
+    private scheduleExpiry;
+    /**
+     * Refresh the authoritative Host projection and schedule its known expiry.
+     * @returns A promise settled after the shared status reflects the response.
+     */
+    load(): Promise<void>;
+    /**
+     * Start the always-mounted browser lifecycle.
+     * @returns A disposer for browser listeners, popup ownership, and expiry timing.
+     */
+    start(): () => void;
+    /** Open the real DataOps authorization handoff from a user gesture. */
+    openAuthorization(): void;
+    /**
+     * Revoke the current grant and refresh shared state.
+     * @returns Whether the disconnect completed and Settings may collapse confirmation.
+     */
+    disconnect(): Promise<boolean>;
+}
+//# sourceMappingURL=controller.d.ts.map

package/lib/types/client/index.d.ts

@@ -0,0 +1,12 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { type DataOpsKey } from './locales.ts';
+declare module '@deepseek-ai/dsh-client-ui-slots' {
+    interface LocaleNamespaceMap {
+        'settings.dataops': DataOpsKey;
+    }
+}
+/** Client services required for the Settings and frame-overlay contributions. */
+export declare const inject: string[];
+/** Register the shared DataOps lifecycle, Settings section, and expiry modal. */
+export declare function apply(ctx: Context): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/client/locales.d.ts

@@ -0,0 +1,39 @@
+/** English DataOps Settings copy. */
+export declare const en: {
+    readonly nav: "DataOps";
+    readonly title: "DataOps";
+    readonly close: "Close";
+    readonly later: "Later";
+    readonly connected: "Connected";
+    readonly loginExpired: "Sign-in expired";
+    readonly loginExpiredHint: "Sign in again to continue using DataOps tools.";
+    readonly notConnected: "Not connected";
+    readonly connectionFailed: "Connection failed";
+    readonly managedByAdministrator: "Managed by administrator";
+    readonly connect: "Connect DataOps";
+    readonly reauthorize: "Authorize again";
+    readonly signInAgain: "Sign in again";
+    readonly disconnect: "Disconnect";
+    readonly confirmDisconnect: "Disconnect this DataOps account?";
+    readonly confirmDisconnectDetail: "You’ll need to connect DataOps again before using this account.";
+    readonly keepConnected: "Keep connected";
+    readonly confirm: "Disconnect";
+    readonly retry: "Retry";
+    readonly loading: "Checking connection…";
+    readonly popupBlocked: "The authorization window could not be opened. Allow pop-ups for this page and try again.";
+    readonly connectFailed: "DataOps connection failed. Try again.";
+    readonly authorizationExpired: "The DataOps authorization request expired. Connect again.";
+    readonly authorizationResponseInvalid: "DataOps returned an incomplete authorization response. Connect again.";
+    readonly tokenRequestRejected: "DataOps rejected the authorization request. Connect again.";
+    readonly tokenAccountRejected: "DataOps rejected the selected account authorization. Sign in again.";
+    readonly tokenServiceFailed: "The DataOps authorization service failed. Try again.";
+    readonly tokenResponseInvalid: "DataOps returned an invalid token response. Connect again.";
+    readonly accountVerificationFailed: "The authorized DataOps account could not be verified. Try again.";
+    readonly authorizationActivationFailed: "The DataOps authorization could not be activated. Try again.";
+    readonly disconnectFailed: "Unable to disconnect DataOps. Try again.";
+};
+/** Stable key set shared by every DataOps Settings locale. */
+export type DataOpsKey = keyof typeof en;
+/** Chinese DataOps Settings copy. */
+export declare const zh: Record<DataOpsKey, string>;
+//# sourceMappingURL=locales.d.ts.map